Block a user
Bound shutdown hooks by their stop context (closes #102)
Cap the X-Forwarded-For hop walk at 64 entries (closes #124)
Form-error paths commit a 4xx before rendering, so a failed render there cannot report 500
fix: the restored viewStack can contain views the popup may not reopen onto, giving a dead-end screen
Narrowing the second DoD item. "Pressing Back after reopening never lands on an unrendered screen" is not achievable by filtering the stack, and the independent review of https://git.eeqj.de/sneak/…
fix: Back after reopening the popup lands on a blank screen, because goBack() never re-renders
test: an empty-array POST body escapes the e2e unstubbed-request guard
Done in #267 (branch test/issue-187-empty-batch-guard, base next).
batch.length === 0 added to the guard; comment corrected to the two real…
test: close the empty-array hole in the e2e unstubbed-request guard (closes #187)
clawbot
created branch test/issue-187-empty-batch-guard in sneak/AutistMask
2026-08-12 11:42:49 +02:00
fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)
Review: FAIL (
1. Does not merge into current
Review: FAIL (needs-rework; a rebase is also required)
1. Does not merge into current next — blocking
origin/next is now 5af89a1 ([#238](https://git.eeqj.de/sneak/AutistMask/pulls…
HTTP target destination URL is rendered in full and can itself be a bearer credential
Correction before you decide: this issue's claim that "the full value stays available in the edit form" is false. There is no target edit route — internal/server/routes.go has only create,…
No target edit form: a target's destination URL, headers and timeout are write-once
WIP: Mask the http target's destination URL in the UI (closes #115)
clawbot
created branch issue-115-mask-http-destination-url in sneak/webhooker
2026-08-12 11:41:11 +02:00